Google
is Running CIA Type Spying On Your Credit Card Purchases

(Bloomberg)
-- For the past year, select Google advertisers have had access to a
potent new tool to track whether the ads they ran online led to a
sale at a physical store in the U.S. That insight came thanks in
part to a stockpile of Mastercard transactions that Google paid for.

But
most of the two billion Mastercard holders aren’t aware of this
behind-the-scenes tracking. That’s because the companies never told
the public about the arrangement.

Alphabet
Inc.’s Google and Mastercard Inc. brokered a business partnership
during about four years of negotiations, according to four people
with knowledge of the deal, three of whom worked on it
directly. The alliance gave Google an unprecedented asset for
measuring retail spending, part of the search giant’s strategy to
fortify its primary business against onslaughts from Amazon.com Inc.
and others.

But
the deal, which has not been previously reported, could raise
broader privacy concerns about how much consumer data technology
companies like Google quietly absorb.

"People
don’t expect what they buy physically in a store to be linked to
what they are buying online,” said Christine Bannan, counsel with
the advocacy group Electronic Privacy Information Center (EPIC).
"There’s just far too much burden that companies place on consumers
and not enough responsibility being taken by companies to inform
users what they’re doing and what rights they have.”

Google
paid Mastercard millions of dollars for the data, according to two
people who worked on the deal, and the companies discussed sharing a
portion of the ad revenue, according to one of the people. The
people asked not to be identified discussing private matters. A
spokeswoman for Google said there is no revenue sharing agreement
with its partners.

A
Google spokeswoman declined to comment on the partnership with
Mastercard, but addressed the ads tool. "Before we launched
this beta product last year, we built a new, double-blind encryption
technology that prevents both Google and our partners from viewing
our respective users’ personally identifiable information,” the
company said in a statement. “We do not have access to any
personal information from our partners’ credit and debit cards, nor
do we share any personal information with our partners.” The company
said people can opt out of ad tracking using Google’s “Web and
App Activity” online console. Inside Google, multiple people
raised objections that the service did not have a more obvious way
for cardholders to opt out of the tracking, one of the people said.

Seth
Eisen, a Mastercard spokesman, also declined to comment specifically
on Google. But he said Mastercard shares transaction trends with
merchants and their service providers to help them measure "the
effectiveness of their advertising campaigns.” The information,
which includes sales volumes and average size of the purchase, is
shared only with permission of the merchants, Eisen added. "No
individual transaction or personal data is provided," he said in a
statement. "We do not provide insights that track, serve up ads to,
or even measure ad effectiveness relating to, individual consumers."

Last
year, when Google announcedthe service, called "Store Sales
Measurement," the company just said it had access to "approximately
70 percent" of U.S. credit and debit cards through partners, without
naming them.

That
70 percent could mean that the company has deals with other credit
card companies, totaling 70 percent of the people who use credit and
debit cards. Or it could mean that the company has deals with
companies that include all card users, and 70 percent of those are
logged into Google accounts like Gmail when they click on a Google
search ad.

Google
has approached other payment companies about the program, according
to two people familiar with the conversations, but it is not
clear if they finalized similar deals. The people asked to not be
identified because they were not authorized to speak about the
matter. Google confirmed that the service only applies to people who
are logged in to one of its accounts and have not opted out of
ad tracking. Purchases made on Mastercard-branded cards
accounted for around a quarter of U.S. volumes last year, according
to the Nilson Report, a financial research firm.

Through
this test program, Google can anonymously match these existing user
profiles to purchases made in physical stores. The result is
powerful: Google knows that people clicked on ads and can now
tell advertisers that this activity led to actual store sales.

Google
is testing the data service with a “small group” of advertisers in
the U.S., according to a spokeswoman. With it, marketers see
aggregate sales figures and estimates of how many they can attribute
to Google ads -- but they don’t see a shoppers’ personal
information, how much they spend or what exactly they buy. The tests
are only available for retailers, not the companies that make the
items sold inside stores,the spokeswoman said. The service only
applies to its search and shopping ads, she said.

For
Google, the Mastercard deal fits into a broad effort to net more
retail spending. Advertisers spend lavishly on Google to glean
valuable insight into the link between digital ads a website visit
or an online purchase. It's harder to tell how ads influence offline
behavior. That’s a particular frustration for companies marketing
items like apparel or home goods, which people will often research
online but walk into actual stores to buy.

That
gap created a demand for Google to find ways for its biggest
customers to gauge offline sales, and then connect them to the
promotions they run on Google. "Google needs to tie that activity
back to a click," said Joseph McConellogue, head of online retail
for the ad agency Reprise Digital. "Most advertisers are champing at
the bit for this kind of integration."

Initially,
Google devised its own solution, a mobile payments service first
called Google Wallet. Part of the original goal was to tie clicks on
ads to purchases in physical stores, according to someone who worked
on the product. But adoption never took off, so Google began looking
for allies. A spokeswoman said its payments service was never used
for ads measurement.

Since
2014, Google has flagged for advertisers when someone who clicked an
ad visits a physical store, using the Location History feature in
Google Maps. Still, the advertiser didn’t know if the shopper made a
purchase. So Google added more. A tool, introduced the following
year, let advertisers upload email addresses of customers they’ve
collected into Google’s ad-buying system, which then encrypted them.
Additionally, Google layered on inputs from third-party data
brokers, such as Experian Plc and Acxiom Corp., which draw in
demographic and financial information for marketers.

But
those tactics didn’t always translate to more ad spending. Retail
outlets weren’t able to connect the emails easily to their ads. And
the information they received from data brokers about sales was
imprecise or too late. Marketing executives didn’t adopt these
location tools en masse, said Christina Malcolm, director at the
digital ad agency iProspect. "It didn’t give them what they needed
to go back to their bosses and tell them, 'We’re hitting our
numbers,’" she said.

Then
Google brought in card data. In May 2017, the company introduced
"Store Sales Measurement." It had two components. The first lets
companies with personal information on consumers, like encrypted
email addresses, upload those into Google’s system and synchronize
ad buys with offline sales. The second injects card data.

It
works like this: a person searches for "red lipstick" on Google,
clicks on an ad, surfs the web but doesn’t buy anything. Later, she
walks into a store and buys red lipstick with her Mastercard. The
advertiser who ran the ad is fed a report from Google, listing the
sale along with other transactions in a column that reads "Offline
Revenue" -- only if the web surfer is logged into a Google account
online and made the purchase within 30 days of clicking the ad. The
advertisers are given a bulk report with the percentage of shoppers
who clicked or viewed an ad then made a relevant
purchase. Mastercard's spokesman said the company does not view
data on the individual items purchased inside stores.

It’s
not an exact match, but it’s the most powerful tool Google, the
world’s largest ad seller, has offered for shopping in the real
world. Marketers once had a patchwork of consumer data in their
hands to triangulate who saw their ads and who was prompted to
spend. Now they had far more clarity.

Google’s
ad chief, Sridhar Ramaswamy, introduced the productin a
blog post, writing that advertisers using it would have "no
time-consuming setup or costly integrations." Missing from the blog
post was the arrangement with Mastercard.

Early
signs indicate that the deal has been a boon for Google. The new
feature also plugs transaction data into advertiser systems as soon
as they occur, fixing the lag that existed previously and letting
Google slot in better-performing ads. Malcolm said her agency has
tested the card measurement tool with a major advertiser, which she
declined to name. Beforehand, the company received $5.70 in revenue
for every dollar spent on marketing in the ad campaign with Google,
according to an iProspect analysis. With the new transaction
feature, the return nearly doubled to $10.60.

"That’s
really powerful," Malcolm said. "And it was a really good way to
invest more in Google, frankly."

But
some privacy critics derided the tool as opaque. EPIC submitted a
complaint about the sales measuring tack to the U.S. Federal Trade
Commission last year. A report in Augustthat
Facebook Inc. was talking with banks about accessing information for
consumer service products sparked similar criticism. For years,
Facebook and Google have worked to link their massive troves of user
behavior with consumer financial data.

And
financial companies have plotted ways to tap into the bounty of
digital advertising. The Google tie-up isn’t Mastercard’s only stab
at minting the data it collects from customers. The company has
built out its data and analytics capabilities in recent years
through its consulting arm, Mastercard Advisors, and gives
advertisers and merchants the ability to forecast consumer behavior
based on cardholder data.

Ad
buyers that work with Google insist that the company is careful to
maintain the walls between transaction information and web behavior,
keeping any info flowing to retailers and marketers anonymous.
"Google is really strict about that," said Malcolm.

Before
launching the product, Google developed a novel encryption method,
according to Jules Polonetsky, head of the Future Privacy Forum, who
was briefed by Google on the product. He explained that the system
ensures that neither Google nor its payments partners have
access to the data that each collect. “They’re sharing data that has
been so transformed that, if put in the public, no party could do
anything with it,” Polonetsky said. “It doesn’t create a privacy
risk.”

Google’s
ad business, which hit $95.4 billion in 2017 sales, has maintained
an astounding growth rate of about 20 percent a year. But investors
have worried how long that can last. Many major advertisers are
starting to funnel more spending to rival Amazon, the company that
hosts far more, and more granular, data on online shopping.

In
response, Google has continued to push deeper into offline
measurements. The company, like Facebook and Twitter Inc., has
explored the use of "beacons," Bluetooth devices that track when
shoppers enter stores.

Some
ad agencies have actively talked to Google about even more ways to
better size up offline behaviors. They have discussed adding
features into the ads system such as what time of day people buy
items and how much they spend, said John Malysiak, who runs search
marketing for the Omnicom agency OMD USA. "We’re trying to go deeper
with Google," he said. "We’d like to understand more." Google
declined to comment on the discussions.